4 ms·

This announcement makes me wonder - Are there any banking laws to protect someone who loses money due to a hack? The JS thing is a huge deal so someone might

This announcement makes me wonder - Are there any banking laws to protect someone who loses money due to a hack? The JS thing is a huge deal so someone might get their online banking credentials stolen and then account emptied. In which case, how helpful are the banks in helping to recover the money? On the cryptocurrency side people need to secure their own money and ensure they don't open some shady ICO site. So stolen credentials means the money is gone forever. Edit: FDIC insurance is applicable for the banks ie if the banks get hacked. The question here is on individuals getting hacked. I am not able to find if FDIC covers that.

duncan-donuts 9y ago
Would the FDIC cover losses?
a_cactus 9y ago
Money in banks is FDIC insured. I believe that protects it from things like hacks, even if the bank itself went bankrupt.
- Cyph0n 9y ago
  For regular consumers, the FDIC insures up to $250k IIRC.
  - walterbell 9y ago
    Insurance companies usually try to reduce/manage risk. Does the FDIC have security / computer / process requirements for the banks which they insure against hacks?
    - Vendan 9y ago
      I think that would be part of the FFIEC https://www.ffiec.gov https://www.ffiec.gov
- twblalock 9y ago
  FDIC insurance doesn't cover theft or fraud. It covers your balance (up to a limit) if the bank fails. There are separate regulations for fraud.
  - taejo 9y ago
    But presumably it does cover your balance if the bank fails because it can't cover a large loss to fraud?
    - Xylakant 9y ago
      The loss in case of fraud against the customer or losses due to a hacked customer is entirely the customer loss. The bank does not care, they don't have any loss. Spectre is an attack against the client and the customer is responsible to keep his client secure. It's not the banks device, they have no power over it.
      - jonknee 9y ago
        That's not how it works though, people get hacked all the time and banks make their customers whole. You can literally leave your debit card on the street corner and you won't be liable for any fraudulent charges as long as you notify the bank of them.
        Xylakant 9y ago
        Not in Europe in general. Chip and PIN leads to the assumption that you made the purchase or initiated the charge. In any case, card charges (or charges in general) are something entirely different than payments initiated from your banking client. Anyone can charge your account and you can dispute the charge. However, money sent from your account cannot actively be disputed. You can tell your bank that you accidentally transferred money and they’ll try and stop the transaction, by if it goes through, you need to retrieve the money from the person that got it. Banks will try to help in case of fraud as long as the money is in their reach, but will not make you whole at their expense.
Ironchefpython 9y ago
> The JS thing is a huge deal so someone might get their online banking credentials stolen and then account emptied. In which case, how helpful are the banks in helping to recover the money? Completely. These are banks we're talking about, not bitcoin exchanges.
rtpg 9y ago
well when the account is emptied, the money will be going places. Seems like a similar scenario to someone stealing your credit card.
deleted 9y ago
[deleted]
twblalock 9y ago
Federal Reserve Regulation E covers bank account fraud. See page 13 of this PDF: https://www.federalreserve.gov/boarddocs/supmanual/cch/efta.pdf https://www.federalreserve.gov/boarddocs/supmanual/cch/efta.... Basically your fraud protection involves your responsibility to notify the bank, and the bank's responsibility to refund the money if you notified them in time. Check your statement or balance at least once every 60 days and report fraud immediately, and you can't lose more than $500. Fraud and theft are not covered by FDIC insurance. FDIC insurance protects your balance, up to a limit, if the bank fails or if there is a run on the bank.
- tzs 9y ago
  OK, so that sounds like it would work out well in the case of ordinary fraud. You notify the bank in timely fashion, and the bank covers it. But in the case of the bank being hacked, I could imagine it affecting enough accounts that the bank cannot cover it. Would that count as the bank failing (or perhaps a run on the bank?), and so then be covered by FDIC insurance? Finally, suppose the hack is a case of financial terrorism. Say, a state sponsored group is trying to undermine confidence in the banking system and so wants to be as disruptive as possible. Instead of just getting in and stealing some money, they have been in for months and have been sabotaging things. They mucked with the backup procedure to make it so the backups are corrupt, and the bank unwisely did not do actual restore tests on samples to check things. Finally, the hackers set everyone's account balance to zero (or more fun, delete everyone's account). So now my bank has no idea how much money I'm supposed to have (or even if I'm a customer). They fail and FDIC steps in. Do the banks have to periodically give the FDIC or other regulators lists of accounts and balances, so that FDIC would be able to at least figure out things up to the last month, say, or would the FDIC also have no idea who gets what?
  - eitland 9y ago
    A few words as a sysadmin: * offsite backups * verified offsite backups (not saying this happens everywhere but I'd expect banks to some kind of routines) A few words as a news reading citizen: * force majeure * fannie mae and freddie mac

duncan-donuts 9y ago

Would the FDIC cover losses?

a_cactus 9y ago

Money in banks is FDIC insured. I believe that protects it from things like hacks, even if the bank itself went bankrupt.

Cyph0n 9y ago
For regular consumers, the FDIC insures up to $250k IIRC.
- walterbell 9y ago
  Insurance companies usually try to reduce/manage risk. Does the FDIC have security / computer / process requirements for the banks which they insure against hacks?
  - Vendan 9y ago
    I think that would be part of the FFIEC https://www.ffiec.gov https://www.ffiec.gov
twblalock 9y ago
FDIC insurance doesn't cover theft or fraud. It covers your balance (up to a limit) if the bank fails. There are separate regulations for fraud.
- taejo 9y ago
  But presumably it does cover your balance if the bank fails because it can't cover a large loss to fraud?
  - Xylakant 9y ago
    The loss in case of fraud against the customer or losses due to a hacked customer is entirely the customer loss. The bank does not care, they don't have any loss. Spectre is an attack against the client and the customer is responsible to keep his client secure. It's not the banks device, they have no power over it.
    - jonknee 9y ago
      That's not how it works though, people get hacked all the time and banks make their customers whole. You can literally leave your debit card on the street corner and you won't be liable for any fraudulent charges as long as you notify the bank of them.
      - Xylakant 9y ago
        Not in Europe in general. Chip and PIN leads to the assumption that you made the purchase or initiated the charge. In any case, card charges (or charges in general) are something entirely different than payments initiated from your banking client. Anyone can charge your account and you can dispute the charge. However, money sent from your account cannot actively be disputed. You can tell your bank that you accidentally transferred money and they’ll try and stop the transaction, by if it goes through, you need to retrieve the money from the person that got it. Banks will try to help in case of fraud as long as the money is in their reach, but will not make you whole at their expense.

Ironchefpython 9y ago

> The JS thing is a huge deal so someone might get their online banking credentials stolen and then account emptied. In which case, how helpful are the banks in helping to recover the money? Completely. These are banks we're talking about, not bitcoin exchanges.

rtpg 9y ago

well when the account is emptied, the money will be going places. Seems like a similar scenario to someone stealing your credit card.

deleted 9y ago

[deleted]

twblalock 9y ago

Federal Reserve Regulation E covers bank account fraud. See page 13 of this PDF: https://www.federalreserve.gov/boarddocs/supmanual/cch/efta.pdf https://www.federalreserve.gov/boarddocs/supmanual/cch/efta.... Basically your fraud protection involves your responsibility to notify the bank, and the bank's responsibility to refund the money if you notified them in time. Check your statement or balance at least once every 60 days and report fraud immediately, and you can't lose more than $500. Fraud and theft are not covered by FDIC insurance. FDIC insurance protects your balance, up to a limit, if the bank fails or if there is a run on the bank.

tzs 9y ago
OK, so that sounds like it would work out well in the case of ordinary fraud. You notify the bank in timely fashion, and the bank covers it. But in the case of the bank being hacked, I could imagine it affecting enough accounts that the bank cannot cover it. Would that count as the bank failing (or perhaps a run on the bank?), and so then be covered by FDIC insurance? Finally, suppose the hack is a case of financial terrorism. Say, a state sponsored group is trying to undermine confidence in the banking system and so wants to be as disruptive as possible. Instead of just getting in and stealing some money, they have been in for months and have been sabotaging things. They mucked with the backup procedure to make it so the backups are corrupt, and the bank unwisely did not do actual restore tests on samples to check things. Finally, the hackers set everyone's account balance to zero (or more fun, delete everyone's account). So now my bank has no idea how much money I'm supposed to have (or even if I'm a customer). They fail and FDIC steps in. Do the banks have to periodically give the FDIC or other regulators lists of accounts and balances, so that FDIC would be able to at least figure out things up to the last month, say, or would the FDIC also have no idea who gets what?
- eitland 9y ago
  A few words as a sysadmin: * offsite backups * verified offsite backups (not saying this happens everywhere but I'd expect banks to some kind of routines) A few words as a news reading citizen: * force majeure * fannie mae and freddie mac